Running pfsense, I was able to route my entire LAN subnet through a VPN. I have firewall and NAT rules that use an alias to filter outgoing connections to specific domains outside of the VPN gateway.
This works great. But here’s the problem. Wildcards are not supported within pfsense aliases, and therefore unless you know the specific subdomain for a service, there’s no way to reroute services that use rotating or load balancing subdomains.
Surely this is a big problem in large companies. I’m sure they utilize a paid solution to solve this problem.
Are there any solutions for self hosting that are FOSS or within pfsense?
You could always just get the entire list of AWS public ranges and use that to identify interesting traffic… Of course that would vpn all AWS stuff.
If you have a list of domains, you could schedule a script to resolve each to IPs and rebuild your VPN definition every night.